What a credit card skimmer is and where they hide

A credit card skimmer is a device or software that reads your card's data without your knowledge. Physical skimmers are small machines criminals attach to card readers — usually at ATMs, gas pumps, or checkout terminals. They capture your card number, expiration date, and sometimes your PIN as you swipe or insert your card. Software skimmers work the same way but live in the payment system itself, invisible to you.

The criminal's goal is to steal enough information to make fraudulent charges or sell your data to someone else. They don't need your physical card — just the numbers and expiration date. Skimmers are most common at unattended machines: ATMs in lobbies or parking lots, self-checkout lanes, and outdoor gas pumps. Indoor attended checkout counters are less common targets because staff are watching.

Key Takeaways

  • Physical skimmers are loose or bulky attachments on card readers that you can spot by tugging on the card slot, keypad, or card reader itself.
  • Gas pumps and ATMs in isolated locations are higher-risk than staffed checkout counters, so inspect them before inserting your card.
  • Covering the keypad with your hand while entering your PIN prevents cameras from recording it, even if your card number is stolen.
  • Check your bank and credit card statements weekly for charges you don't recognize, because catching fraud early limits your liability.
  • If you find a skimmer, do not remove it — report it to the business or police so they can preserve evidence and warn other customers.

How to inspect a card reader before you use it

Start with your eyes and hands. Look at the card slot, keypad, and any reader panel. A skimmer often looks like it doesn't quite fit — it may be slightly raised, a different color, or have loose edges. Run your fingers around the edges of the card slot and keypad. A legitimate reader is flush and solid. A skimmer will feel loose, bulky, or like it's sitting on top of the real reader.

Gently tug on the card slot itself, the keypad buttons, and any other removable-looking part. Don't yank hard — just a firm tug. If something moves or comes loose, stop. Do not use that machine. At gas pumps, check that the cabinet door is sealed and not damaged. At ATMs, look for signs of tampering: scratches, glue residue, or panels that don't align properly.

If you're uncertain, use a different machine. There is no penalty for walking to another ATM or gas pump, and your caution costs you nothing. Criminals count on people being in a hurry.

Protecting your PIN from hidden cameras

Even if a skimmer captures your card number, a thief still needs your PIN to withdraw cash from your account. Many skimmers include a hidden camera pointed at the keypad to record PINs as people enter them. You can defeat this with a simple habit: cover the keypad with your other hand while you type.

Use your palm or fingers to shield the keypad from view. This blocks any camera angle and makes it much harder for someone watching over your shoulder to see what you're typing. Do this at every ATM and every PIN-entry terminal, whether you suspect a skimmer or not. It takes two seconds and costs nothing.

What to do if you think you've found a skimmer

Do not remove it. Removing a skimmer destroys evidence and may interfere with a police investigation. Instead, report it immediately to the business that owns the machine. If it's a gas station, tell the attendant. If it's an ATM in a bank lobby, find a staff member. If it's an outdoor ATM, call the bank's customer service number on the back of your card.

You can also call the local police non-emergency line and report the location and what you found. Give them the business name, address, and machine type. Police in areas with skimmer problems sometimes monitor reports and can act quickly. The business and police can then secure the machine and preserve evidence.

After reporting, monitor your accounts. Check your bank and credit card statements within a few days to see if any unauthorized charges appear. If you used that machine, consider calling your bank to let them know you may have been exposed, so they can watch your account more closely.

Monitoring your statements for fraud

The best defense after a potential skimming is catching fraud early. Check your bank account and credit card statements at least once a week, not just once a month. Many banks and card issuers offer free alerts — you can set them to notify you by text or email whenever a charge over a certain amount posts, or whenever any charge posts to your account.

Look for charges you don't recognize, even small ones. Criminals sometimes test a stolen card with a small purchase first to see if it works before making larger charges. If you spot something unfamiliar, call your bank or card issuer immediately. The phone number is on the back of your card. Do not use the number from an email or text, because those can be fake.

Report the fraudulent charge and ask the bank to cancel your card and issue a new one. Most banks reverse fraudulent charges within one to two billing cycles, and federal law limits your liability to $50 if you report it promptly. If you wait months to report it, your protection may be weaker.

Lower-risk ways to pay

Chip readers are harder to skim than magnetic stripe readers because the chip creates a unique code for each transaction. If a machine offers both, use the chip. Insert your card into the slot rather than swiping. Contactless payments — tapping your phone or card — are also safer because they don't expose your full card number to the reader.

At gas pumps, pay inside with the attendant rather than at the pump if you're concerned. You'll hand over your card to a person, not a machine, and the attendant processes it in front of you. This eliminates the risk of a skimmer on the pump itself. The trade-off is that it takes longer, but it's an option if you're in an area with known skimming problems.

Frequently Asked Questions

Can a skimmer read a chip card?

Chip cards are much harder to skim because the chip generates a unique code for each transaction. A skimmer that captures your chip data can't reuse it like it can with a magnetic stripe. However, many chip readers still have a magnetic stripe fallback, so criminals can sometimes still skim the stripe. Use the chip slot when available.

What should I do if my card was used fraudulently after I used a skimmed machine?

Call your bank or card issuer immediately using the number on the back of your card. Report the fraudulent charges and ask them to cancel your card and send a replacement. The bank will investigate and reverse the charges. Federal law limits your liability to $50 if you report it within 60 days of your statement date, and most banks waive even that.

Are online payment systems vulnerable to skimmers?

Skimmers target physical card readers, not online checkout pages. However, malware on your computer or phone can capture your information when you type it. Use strong passwords, keep your device software updated, and avoid entering card details on public Wi-Fi networks. Online fraud is a different risk from skimming.

How common are credit card skimmers?

Skimmers are most common at gas pumps and outdoor ATMs, particularly in areas with high foot traffic. They're less common at staffed checkout counters and indoor ATMs in banks. The exact frequency varies by region and changes seasonally. The best approach is to inspect every machine before using it, regardless of location.

Can I get my money back if a skimmer was used on my debit card?

Yes, but the timeline and your liability depend on how quickly you report it. If you report unauthorized debit card charges within two business days, your liability is capped at $50. If you wait longer, your liability can go up to $500. Report suspected fraud immediately to your bank to protect yourself.